When correcting a crash in CVS [1] it was found that the CVS client suffers from a flaw that causes a heap overflow. If certain conditions are met, glib SIGABRTs the process because glibc memory management structures become corrupted. The flaw is in the proxyconnect() function (src/client.c), where sscanf() copies the first word from readbuf to writebuf without checking if there is enough space in writebuf.

This could allow a malicious HTTP proxy server to cause a denial of service to CVS clients or, possibly, execute arbitrary code on the client system with the privileges of the user running cvs, by sending a malicious HTTP response code to the connecting client.

[1] https://bugzilla.redhat.com/showbug.cgi?id=773699